4) Cookie notice, & Cookie consent banner (user’s consent to cookies)
All GOV websites need to meet GDPR (General Data Protection Regulation) compliance. As campaign managers, you will be responsible for writing a Cookie Notice for your Campaign Platform site.
Any campaigns driving traffic to the site via digital advertising (eg Facebook Pixel, Linkedin Insights) should ensure these cookies are listed transparently in their Cookie Notice.
Review an example Campaign Platform Cookie and Privacy notice
You will need to speak to your department’s Data Protection Officer for full guidance.
Auditing the cookies used on your campaign
You can audit the cookies used on your campaign to help with writing your cookie policy. You will be able to identify the cookies your campaign uses, the purpose of those cookies, and how long the cookies are retained on a user’s device.
You can audit the cookies used on your campaign using a cookie auditing tool. If you have imported scripts using Google Tag Manager, you can use a cookie auditing tool or contact the suppliers of the scripts for more information.
For example, if you’re using Facebook Pixel you can contact Facebook to understand which cookies are set, how they’re used and how long they’re retained.
Webbkoll, Attacat, Cookiebot and OneTrust are all examples of cookie auditing tools. The results presented by cookie auditing tools may not be 100% correct as it is not an exact science.
If your campaign only uses Google Analytics ( _gat, _gid, _ga) – and you do no digital marketing/tracking whatsoever, then your campaign will be covered by the “GDS boiler plate” cookie notice. But you still need to confirm this with the GDS Product Manager to publish this.
Writing your cookie notice
Once you’ve identified the cookies used by your campaign, their purpose and how long they’re stored, you can write your cookie policy. Follow the guidance from the GOV.UK Service Manual to help you write it.
You should outline:
- the application or script setting cookies, e.g. Google Analytics
- why and for what purpose the application uses cookies
- a table showing each of the application’s cookies, their purpose and their expiry.
Publish your cookie notice
Once your cookie notice has been approved by your data protection officer, please send it to the current campaign platform Product Manager at GDS, who can publish it for you.
Google Tag Manager
If you use Google Tag Manager for importing scripts, such as Google Analytics or Hotjar, you will need to consider the impact of those scripts on a user’s privacy.
Google Analytics
Some campaigns use Google Tag Manager to import Google Analytics, and it’s advisable to anonymise IP addresses collected by Google Analytics. You can follow this guide on the Google advertiser forums.
Other platforms
You will need to consider anonymising IP addresses collected by other platforms for analytics, feedback, social sharing and any other scripts you’ve imported using Google Tag Manager.
Privacy Electronic Communications Regulations (PECR) compliance & cookie consent banners
A user’s consent is required for “non-essential cookies” : this is third-party cookies used for online advertising (eg Facebook Pixel, Linkedin Insights) or analytics (eg Google Analytics). Website users must take a clear and positive action to consent to these non-essential cookies – by a pop-up consent banner presented to all visitors to your website ( a choice for users to either “accept” or “decline” cookies ).
Campaign managers must take action to implement a Cookie consent banner before the site is made live.
A GOV.UK designed fully accessible cookie consent plug-in mechanic is built into the campaign platform. When building your page, this can be found in the “Cookies & Analytics” section of the campaign platform.
To use the mechanic : select the ‘Cookies and Analytics’ option from the left hand menu of the WordPress Administration interface. Check the box titled ‘Use gov.uk-style cookie settings’. Enter the Google Analytics ID you have been provided.
If you are using Facebook Pixel, LinkedIn Insight or Google Floodlight Tags then check the box titled ‘Include marketing scripts’ and enter the appropriate tags. You are responsible for managing these digital marketing services.
Please remember the mechanic will not automatically update your cookies and privacy policy with any new digital marketing/tracking tools, and will need to be updated if you add these on. The draft will need to be approved by your DPO, and then emailed to the current GDS Product Manager for publishing.
NB : If you are using Marketing Cookies, the new plug-in mechanic caters for Facebook Pixel, Google Floodlight and Linkedin Partner ID only. If you are using additional digital marketing “tags” (in Google Tag Manager), you will instead have to use a 3rd party Cookie Consent tool (such as CookieBot or Civic). This is because the new plug-in mechanic cannot accommodate any tags above and beyond Facebook Pixel, Google Floodlight and Linkedin Partner ID.
Please visit this page if you need to deploy CookieBot.